24 ms·
Tell HN: GitHub is partially blocked in India
GitHub is being partially blocked in India by a prominent ISP (ACT) across multiple states under a sealed court order.
You can find multiple reports here: https://twitter.com/search?q=Github%20%40actfibernet https://twitter.com/search?q=Github%20%40actfibernet. It has shown up in news reports: https://timesofindia.indiatimes.com/gadgets-news/github-content-domain-blocked-for-these-indian-users-reports/articleshow/96687992.cms https://timesofindia.indiatimes.com/gadgets-news/github-cont...
ACT is using SNI-sniffing to block raw.githubusercontent, unlike most other blocks, which are DNS based. ACT's block page claims it is under a court order to block the domain:
> curl http://raw.githubusercontent.com/ http://raw.githubusercontent.com/
> This URL has been blocked under the instructions in compliance with the orders of a Hon'ble Court.
(Using HTTPS results in a dropped connection).
Unfortunately, there is no easy way to find out if there is even a court order behind this block. A few times court orders are leaked, and a court case to get a single order published took 3 years[0] . Other ISPs are known to block websites without court-order due to technical issues[1]
for the last few weeks, GitHub previews on the website have refused to load, alongside some other interesting cases, such as extension previews breaking on VS Code (, Obsidian etc).
Hopefully, GitHub is fighting a case to get this unblocked, and given the resources it has, to challenge the law here as well (the law gives no recourse as it stands).
[0]: https://internetfreedom.in/delhi-hc-directs-meity-to-provide-a-copy-of-the-blocking-order-and-a-post-decisional-hearing-to-mr-tanul-thakur-whattheblock/ https://internetfreedom.in/delhi-hc-directs-meity-to-provide...
[1]: https://github.com/captn3m0/hello-cloudflare/ https://github.com/captn3m0/hello-cloudflare/
- coliveira 4y agoThe best thing to do is to create a national git service and make copies of the important git repos, to avoid this problem.
- kimbernator 4y agoAt best that severs collaboration between India and the rest of the world when github isn't blocked. And who would get to define "important"? Switch that word out with "approved" and you'd have a more accurate picture of what would be present. One of the benefits (or perhaps "ideals" would be a better word) of open source is that all of it is available to everyone with no authority deciding who can access it.
- coliveira 4y ago> it is available to everyone with no authority deciding who can access it So why are you using a Microsoft product, where Microsoft decides where and when the service will be available?
- captn3m0 4y agoIt exists: https://openforge.gov.in/ https://openforge.gov.in/ (Its a https://www.tuleap.org/ https://www.tuleap.org/ instance, hosted by MEITY (National E-Governance Division).
- jhoelzel 4y agouff. I cant even imagine what loosing github would mean to an economy and hope you will be back on track soon.
- sanghi_mama 4y agoIt won't do anything to the economy. It's only social media and whatsapp that's required by you-know-which-majority-religion terrorist accounts to spread venom and hate speech against other communities. source: https://www.bbc.com/news/world-asia-india-61090363 https://www.bbc.com/news/world-asia-india-61090363
- deleted 4y ago[deleted]
- sanghi_mama 4y ago[flagged]
- jehadi_mulla 4y ago[flagged]
- philippejara 4y agoI doubt it would mean much, you don't even need to self-host git just use gitlab, bitbucket, etc. Hobbyists and small projects would be the most affected but VPN's are a trivial solution for this demographic.
- alkonaut 4y agoThe code you need to read, the bugs you need to file and the downloads you need to make from every other project will still be on GitHub. I don’t use GitHub for issues or version control at work, but I’d be significantly slowed down without it.
- philippejara 4y ago
- ignoramous 4y agoFor folks looking to bypass these rudimentary DPI blocks, you don't really need a VPN. DoH + one of these should be enough On Windows: - GoodbyeDPI: https://github.com/ValdikSS/GoodbyeDPI https://github.com/ValdikSS/GoodbyeDPI (https://ntc.party/c/community-software/goodbyedpi/8 https://ntc.party/c/community-software/goodbyedpi/8) On Mac / Linux: - GreenTunnel: https://github.com/SadeghHayeri/GreenTunnel https://github.com/SadeghHayeri/GreenTunnel (https://www.npmjs.com/package/green-tunnel https://www.npmjs.com/package/green-tunnel) On Android: - Intra: https://github.com/jigsaw-code/intra https://github.com/jigsaw-code/intra (https://play.google.com/store/apps/details?id=app.intra https://play.google.com/store/apps/details?id=app.intra) - (I co-maintain this) Rethink DNS + Firewall: https://github.com/celzero/rethink-app https://github.com/celzero/rethink-app (https://play.google.com/store/apps/details?id=com.celzero.bravedns https://play.google.com/store/apps/details?id=com.celzero.br...)
- themitigating 4y agoHow about standing up to the people who implemented the ban and their supporters. I don't understand why we are working around oppression.
- deleted 4y ago[deleted]
- saghm 4y agoTechnical workarounds and social activism aren't mutually exclusive; given how long the latter can take to achieve results, it's often useful to have the former in the meantime.
- themitigating 4y agoBy bypassing the block you lessen the need for social activism
- rvz 4y agoOr just self-host your repositories and don't deal with centralized Git services given that techies here are hyping around how 'easy' it is to spin up Mastodon instances. Should be even easier to self-host a Git repository then, just like a website.
- eatonphil 4y agoHasn't GitHub been de jure, if not de facto, banned in India since 2014? https://en.wikipedia.org/wiki/Censorship_of_GitHub#India https://en.wikipedia.org/wiki/Censorship_of_GitHub#India
- prcrstntr 4y agoNah works fine on my ISP
- deleted 4y ago[deleted]
- karatinversion 4y agoThat is what “de jure, not de facto” means - the ban is in place, but widely ignored and unenforced
- hhjinks 4y agoNot "not de facto," "if not de facto." Definitely not de facto if some ISPs don't block it.
- unmole 4y agoNo. The ban was lifted in a matter of days.
- deleted 4y ago[deleted]
- tanduv 4y ago> Unfortunately, there is no easy way to find out if there is even a court order behind this block not easy, but have you tried filing a RTI application regarding this? https://rtionline.gov.in/ https://rtionline.gov.in/
- boruto 4y agoYou think this if this is a seesions court order could be found by RTI?
- captn3m0 4y agoThe government has never published a blocking order. RTI has failed, and there's no due process if your website has been blocked. Here's the government defending their stance of keeping these secret: https://internetfreedom.in/meity-defends-blocking-of-satirical-dowry-calculator-website/ https://internetfreedom.in/meity-defends-blocking-of-satiric...
- UI_at_80x24 4y agoAs a friendly reminder, an SSH SOCKS5 proxy is _VERY_ easy to implement.
- inthewings 4y agoIf that's a "court order", there's traces, unlike the the Meity bans thingie which are designed as a legal loophole and almost impossible to lift.
- rvz 4y agoA great time to consider self-hosting your Git repositories then? Like all the inflated hype in the news with the federation 'goobledegook' and 'technobabble' with Mastodon and alternatives with techies spinning up instances, perhaps it is about time that techies use Git properly and consider self-hosting your repositories just like how many techies do with self-hosting Mastodon instances? I don't think there is an excuse to continue using GitHub or a centralized provider that can easily be censored by governments or GitHub themselves censoring other repositories via its ToS either way; when developers of GNOME, Wireguard, Redox, etc are already able to self-host their own code on their websites. If they can self-host their own code and federated networks, you (techies) can also do it too.
- nottorp 4y agoExcept moving your repo is a matter of changing the origin, pushing and notifying your co workers. It's not like moving social network identity, and it saves some admin burden. If you use just the repo feature, that is. If you fall into the trap of using GitHub's other services you have vendor lock in and you're more screwed than when considering moving from Twitter to Mastodon.
- bastardoperator 4y agoYour instructions would only apply to a dead repo. Migrating an active repo is going to require coordination, dry runs, validation, and planning coupled with updates across your integrations. If you rewrite any history, all bets are off. You're also not taking into account any cleanup activities like reflog expire, or gc prune. I would also argue that moving to a self hosted remote is going to have significant administrative burden when it comes to security and updates compared to anything SaaS. Most people use GitHub, GitLab, and Bitbucket for the collaboration features, everyone already knows they can run vanilla git and actively choose not to.
- nottorp 4y ago> updates across your integrations That's already vendor lock in - you're using GitHub's CI pipeline? You're locked.
- thewhitetulip 4y agoYou want to know a funny thing? I am getting the same error on my Idea sim since more than a month now. I even posted to HN last month but I couldn't figure out what was wrong. It was only later that I realised that Idea was blocking ddg
- josephcsible 4y ago> ACT is using SNI-sniffing to block raw.githubusercontent, unlike most other blocks, which are DNS based. This is why TLS ECH can't come soon enough, and why there should be no fallback if the browser and server both support it.
- netheril96 4y agoHere in China the GFW block any traffic with encrypted SNI.
- josephcsible 4y agoHence the "no fallback" point. Bad guys can always block entire IPs, and by not having a fallback to insecure SNI, that's their only choice.
- silon42 4y agoAs someone who doesn't want untrusted devices on my network, I'd want to be able to encrypt SNI at my firewall.
- josephcsible 4y agoHow do you propose things be set up such that it's possible for you to enforce that at your firewall without censorious governments being able to at theirs?
- bornfreddy 4y agoWhat do untrusted devices have to do with this? You should be able to block them at lower layers already, and if not, I don't see how decrypting the FQDN of a request would help. Am I missing something?
- jrockway 4y agoDoesn't that mean that places like AWS will be fighting ECH, then? Right now, evil governments can block sites based on their domain; so if irrelevant-aws-customer.com does something controversial, super-important-customer-also-on-aws.com can still receive traffic. If evil governments lose this ability and irrelevant-aws-customer.com needs to be blocked, then they just block all of AWS, forcing super-important-customer-also-on-aws.com to move to Azure or GCP. As a result, I imagine that big cloud providers to whine loudly about this, unless they have some other plan. (I also think we should ignore their whining, but the #1 browser is made by the #3 cloud provider, so I have my doubts. What hurts AWS hurts GCP, probably.)
- yunohn 4y agoThe insane irony of this given the sheer number of Indians working in software/IT and using GitHub and contributing to India’s GDP. You’d think that the Gov/ISP/Courts, somebody would put GitHub on a Do-Not-Block list and stop this madness.
- sanghi_mama 4y ago[dead]
- sanghi_mama 4y ago[flagged]
- yunohn 4y agoI wouldn’t say 7-10% of GDP is nothing - https://www.gavstech.com/contribution-of-the-it-industry-in-indias-gdp/ https://www.gavstech.com/contribution-of-the-it-industry-in-....
- humanistbot 4y agoMost people in "the IT industry" are not coders and do not need github, a code repository, or even the most basic understanding of coding in order to do their jobs. Install a satellite dish? You're an IT worker. Do customer service for a telecom? You're an IT worker. Swap out failing hard drives in a server farm? You're an IT worker. The impact of github being down is large, but it isn't going to take out 7-10% of India's GDP.
- jehadi_mulla 4y ago[flagged]
- ummonk 4y agoMost Indian government bureaucrats won't understand tech. Court judges are even worse; not only will they not understand tech, but as unelected officials they don't even particularly care about the economy, and are accountable to no one but themselves.
- coliveira 4y agoThe fact that people rely on GitHub, even when it is based on git, which is free and distributed software, shows how easy it is for big companies to force users into their closed software.
- nmz 4y agoI don't see how that is relevant. of what worth is git if the website where you fetch most of your repos is dead?
- BlueTemplar 4y agoIt's relevant because the repo owner can just point you to other git peers.
- bastardoperator 4y agoGitHub is free for individuals and OSS projects... Most people don't want to manage their own vanilla Git server. GitHub, GitLab, and Bitbucket provide collaboration features you'll never see in Git.
- xigoi 4y agoSourceHut, Notabug, Codeberg, etc. are free in both money and liberty, unlike GitHub.
- bastardoperator 4y agoHow are you being oppressed by a SaaS offering that charges you nothing and uses a standard protocol (git)?
- xigoi 4y agoIt uses your code in a paid closed-source service (Copilot), and creates vendor lock-in using proprietary features like GitHub Actions. Not to mention that it's quite absurd for the majority of free software projects to be hosted on a proprietary platform.
- SanjayMehta 4y agoAnyone can approach any state high court and get an order to block any website in India. The ISPs will block immediately and then the victims have to work the court system to get unblocked. Videolan (VLC) was blocked for months. I don't know if the block was ever actually lifted as we use dnscryptd on our networks.
- captn3m0 4y agoThe VLC block was lifted[0,1] after VLC filed a legal notice[2] with IFF's help. It was blocked for somewhere around 3-4 months at the very least. [0]: https://techcrunch.com/2022/11/14/india-lifts-download-ban-on-vlc/ https://techcrunch.com/2022/11/14/india-lifts-download-ban-o... [1]: https://twitter.com/internetfreedom/status/1592095634013949962?lang=en https://twitter.com/internetfreedom/status/15920956340139499... [2]: https://internetfreedom.in/videolan-issued-legal-notice-to-dot-and-meity-for-banning-their-website-in-india/ https://internetfreedom.in/videolan-issued-legal-notice-to-d...
- bbbbb5 4y ago[flagged]
- robofanatic 4y ago> Let's keep posting anti-BJP content on Github lets keep politics out of github please. let it be just about code not some propagandist news outlet.
- Dreako 4y agoas an indian in india, its working just fine in my ISP BJP isnt trying to "censor" "dissent" here, its just one ISP blocking it for some unspecified reason its not that deep, everything you see on reddit isnt real, you can calm down.
- FlyingSnake 4y agoAs much as I like questioning the government, let's please keep partisan politics out of HN. It gets tiring to read the same tropes again and again. Indian government has a long documented history of banning things without much thought and it looks one such case. I hope it gets resolved soon as other users are reporting that they can access it fine.
- IceWreck 4y agoNot that it matters (bypasses exist), but why do you want the Indian govt to completely block github ?
- bbbbb5 4y ago[flagged]
- sbmthakur 4y agoTwitter isn't banned in India despite having that kind of content.
- jacooper 4y agoBecause they order twitter to hide accounts they don't like in India.
- hectorm 4y agoCan anyone from India confirm if this proxy server [1] is enough to bypass the block? Basically it is a proxy that alters HTTPS traffic to prevent DPI systems from detecting the domain during the TLS handshake. At least in Spain it works for me to bypass the blocking of the major ISPs [2]. [1] https://github.com/hectorm/demergi https://github.com/hectorm/demergi [2] https://github.com/hectorm/demergi/blob/master/ISP.md https://github.com/hectorm/demergi/blob/master/ISP.md
- girishso 4y agodemergi works great to open blocked sites
- selfhoster69 4y agoCan you explain in detail how this is supposed to work? Am I supposed to run this (Docker here) on my local server or on a remote server that the block is not affecting??
- hectorm 4y agoYou should run it inside the network affected by the blockage. If you use Docker you can run the following command to start the server and configure your browser to use it as an HTTP proxy. docker run -p 8080:8080 docker.io/hectorm/demergi:latest
- madmax108 4y agoCan confirm that demergi works to circumvent the block, as does greentunnel [1] [1]: https://github.com/SadeghHayeri/GreenTunnel https://github.com/SadeghHayeri/GreenTunnel
- anshumankmr 4y agoI was really confused as to why some content for me was getting blocked.
- COMMENT___ 4y agoGitHub is based on a decentralised version-control system, so this is not a problem. Right? ;)
- mmq 4y agoA lot of teams use additional services from Github besides pushing code. They run their CI system using actions (including building docker images for prod), they keep knowledge/metadata on issues, PRs, comments, discussions, Kanban/project management, ... Not having access to GH could be paralyzing.
- zakember 4y agoIndian here. This seems to be blown a bit out of proportion. I am residing in a Tier-1 city in India and have an internet connection with a local ISP. I am able to access the content on the supposed blocked domain, so this is probably one ISP proactively blocking the domain without it being formally asked to do so (court order can't be ISP-specific AFAIK). I work in a large consultancy firm and have friends in other Indian IT consultancy firms. GitHub is very commonly used across these firms for quite large projects and blocking that domain would certainly slow down the work of thousands of employees across the country instantly. No way can this block be carried ahead.
- burhanuday 4y agoCan confirm. Facing the same issue on jio fiber in mumbai. Can't open raw GitHub links at all. Get a timeout error
- captn3m0 4y agoI did mention that it's only ACT blocking it so far. > one ISP proactively blocking the domain without it being formally asked to do so Very unlikely. Court orders are not ISP specific, but ISPs are not time-bound to apply them. It's all very secretive, so there's really no way for us to find out. It's better to assume the worst (ACT is blocking it on a court-order, and more ISPs might follow). Other ISPs are known to do blocks without court orders (mainly Jio and BSNL) but ACT - not so much. It has been blocked for almost a week, with small media coverage, little outrage, and no response.
- shdjzkkanksnd 4y agoACT broadband user here, never had any issues with GitHub being blocked at all. It might be a localised issue to a certain city.
- captn3m0 4y agoreports on twitter have the block confirmed across 3 states.
- 4y ago
- deleted 4y ago[deleted]
- sairamkunala 4y agoPointing to cloudflare dns circumvents the issue for now. move away from ISP DNS to 1.1.1.1 to temporarily solve the issue.
- Dreako 4y agocloudfare + OpenDNS . works like a charm
- pritambaral 4y agoSome ISPs still tamper with DNS traffic irrespective of which DNS server they're to/from. githubusercontent.com has no DNSSEC, so it's not tamperproof.
- uncletammy 4y agoThrough what mechanism is it possible for them do bypass custom DNS servers? Does DNS over other protocols prevent this tampering?
- pritambaral 4y agoDNS traffic is plaintext. MITM is all that's needed to be able to bypass custom DNS servers. An ISP, obviously, has to be in an MITM position to be able to provide internet service. Here's an example: https://jeff.vtkellers.com/posts/technology/force-all-dns-queries-through-pihole-with-openwrt/ https://jeff.vtkellers.com/posts/technology/force-all-dns-qu...
- tptacek 4y agoIt wouldn't be tamperproof even with DNSSEC for most of that ISP's customers, because DNSSEC is server-to-server, and collapses down to a single "yep, we checked DNSSEC" bit in the response header. This is a big part of why nobody does DNSSEC, and why the browsers adopted DNS-over-HTTP to solve this particular problem.
- alkonaut 4y agoIs there any guesses as to why it’s blocked? What’s Microsoft’s reaction?
- Dreako 4y agoits actually not blocked, it works just fine for most ISPs here
- ooni 4y agoThe Open Observatory of Network Interference project monitors the Internet to detect censorship - https://ooni.org https://ooni.org We are a no-profit and network measurements are provided by volunteers. You can browse our data regarding raw.githubusercontent.com on: https://explorer.ooni.org/chart/mat?probe_cc=IN&test_name=web_connectivity&domain=raw.githubusercontent.com&since=2022-11-04&until=2023-01-04&axis_x=measurement_start_day https://explorer.ooni.org/chart/mat?probe_cc=IN&test_name=we... https://explorer.ooni.org/chart/mat?probe_cc=IN&test_name=web_connectivity&domain=raw.githubusercontent.com&since=2022-11-04&until=2023-01-04&axis_x=measurement_start_day&axis_y=probe_asn https://explorer.ooni.org/chart/mat?probe_cc=IN&test_name=we...
- captn3m0 4y agoThanks for sharing this, clearly shows ACT DNS blocks. There's DNS tampering on Jio as well: https://explorer.ooni.org/measurement/20230103T215427Z_webconnectivity_IN_55836_n1_irCR1o139Bl6lFlo?input=https%3A%2F%2Fraw.githubusercontent.com%2Fooni%2Fspec%2Fmaster%2FREADME.md https://explorer.ooni.org/measurement/20230103T215427Z_webco...